Privacy policy
Last updated: October 2026
Costa Brava Estates S.L. (hereinafter, "the Agency") respects your privacy and processes your personal data in accordance with Regulation (EU) 2016/679 (GDPR) and Spanish Organic Law 3/2018 (LOPDGDD). This policy explains what data we collect through inmobiliaria-zeta-dusky.vercel.app, what we use it for and what rights you have.
Owner details
- Owner
- Costa Brava Estates S.L.
- Address
- Calle Mayor 1, 46700 Gandía, Valencia
- info@costabrava.com
- Phone
- +34 600 000 000
1. Data controller
The data controller is Costa Brava Estates S.L., whose identification and contact details appear at the top of this page. For any question about your data you can write to us at info@costabrava.com. The Agency contracts the technology platform of this website from a provider that acts as data processor and only processes data following the Agency's instructions.
2. What data we process
• Identification and contact details you give us in forms (name, email, phone) and the content of your message. • Details of the property you want to sell or rent (address, features and, where applicable, expected price). • Your search preferences and favourite properties, if you have an account. • Your client account details (name, email and password, which is stored encrypted). • Contact details we receive from property portals where we advertise properties (for example Idealista or Fotocasa) when you request information there. • Technical browsing data (IP address, browser, device), needed for the security of the service and, only if you accept the relevant cookies, for statistics. We do not process special categories of data and we do not ask for identity documents through the website.
3. What we use your data for and the legal basis
• Answering your enquiry, viewing request or valuation request: your consent (Art. 6.1.a GDPR) and pre-contractual measures taken at your request (Art. 6.1.b). • Managing the brokerage of property sales or lettings and the commercial relationship: performance of a contract or pre-contractual measures (Art. 6.1.b). • Managing your client account, favourites and enquiries: performance of the service you request (Art. 6.1.b). • Sending you new-property alerts and commercial emails: your consent (Art. 6.1.a GDPR and Art. 21 LSSI-CE), which you can withdraw at any time. • Complying with legal obligations of the real estate business, such as anti-money-laundering and tax rules: legal obligation (Art. 6.1.c). • Keeping the website secure and preventing spam and fraud: legitimate interest (Art. 6.1.f). • Measuring website use, only if you accept the relevant cookies: your consent (Art. 6.1.a). If you do not provide the mandatory data in a form we will not be able to deal with your request.
4. How long we keep your data
• Enquiries and requests with no later transaction: up to two years from the last contact. • Data linked to a completed transaction: for the applicable legal periods (generally between 5 and 10 years depending on civil, tax and anti-money-laundering rules). • Client account: until you delete it from your profile or ask us to. • Alert subscription: until you unsubscribe. After these periods the data is deleted or anonymised.
5. Who we share your data with
We do not sell your data. It may be accessed by: • Providers that serve the Agency as data processors, under a contract compliant with Art. 28 GDPR: web hosting (Vercel Inc.), database and authentication (Supabase Inc.) and email delivery (Resend). • Owners, buyers or tenants involved in a transaction, when you ask us or when needed to manage it; and notaries, land registries, advisers or financial institutions if you complete a transaction through us. • Public authorities, courts and law enforcement, where there is a legal obligation. The website's maps are loaded from OpenStreetMap, which receives your IP address when they are displayed.
6. International transfers
Some of the providers above may process data outside the European Economic Area (for example in the United States). In those cases adequate safeguards apply: an adequacy decision (such as the EU-US Data Privacy Framework) or the European Commission's standard contractual clauses. You can ask us for more information at info@costabrava.com.
7. Your rights
You can exercise your rights of access, rectification, erasure, objection, restriction of processing and portability at any time, and withdraw your consent, by writing to info@costabrava.com. State the right you want to exercise and, if needed to verify your identity, attach a copy of your identification document. We will reply within one month. If you have a client account you can also edit your data or delete your account from your profile. If you believe your rights have not been respected you can lodge a complaint with the Spanish Data Protection Agency (www.aepd.es).
8. Commercial communications
We will only send you alerts or commercial emails if you have subscribed. Every email includes a one-click unsubscribe link. Service emails (reply to your enquiry, account confirmation, password recovery) are not commercial.
9. Minors
This website is not aimed at children under 14. If you are under that age, you must not give us personal data without the authorisation of your parents or guardians.
10. Security and automated decisions
We apply appropriate technical and organisational measures: encrypted communications (HTTPS), encrypted password storage, role-based access control and separation of each agency's data. We do not take decisions based solely on automated processing that produce legal effects on you. If you subscribe to alerts, we use your search criteria to notify you of matching properties; we do not build any other profile.
11. Changes to this policy
We may update this policy to reflect legal or service changes. The date of the last update appears at the top of this page.